[pve-devel] [RFC manager 0/3] #fix 6094: relax permissions of informational api endpoints

[Daniel Kral]

Small patch series which relaxes the permissions needed for purely
informational API endpoints (i.e. do not modify system state, but only
read it) from "Sys.Modify" to accept any of "Sys.Modify" or "Sys.Audit".
The same has been done for other, similar API endpoints as well [0].

The initial bug report only included the API endpoint for fetching a
list of available updates on a node (GET `/nodes/{node}/apt/update`),
but it made sense to include other endpoints where this applies as well,
at least as an RFC.

This does preserve backwards compatibility for the
odd case where a user/token has only the "Sys.Modify" but not the
"Sys.Audit" permission on the previous paths.

As for the other commit [0], I didn't bother to adapt the WebGUI as
Resource Mappings, Updates and ACME are not accessible there now. If
there is more user interest to e.g. read the list of available updates
without being able to refresh or upgrade them, it should be an easy fix,
but should be done together with PMG (and possibly PBS) as those
components are defined in proxmox-widget-toolkit.

[0] https://git.proxmox.com/?p=pve-manager.git;a=commit;h=65cbfe79e49638c10acce4354182dcaeae96e74d

Daniel Kral (3):
  fix #6094: api: apt: allow to get packages info with Sys.Audit
  fix #6094: api: node HW: allow to get usb info with Sys.Audit on /
  fix #6094: api: acme: allow to get plugin info with Sys.Audit on /

 PVE/API2/ACMEPlugin.pm   | 4 ++--
 PVE/API2/APT.pm          | 4 ++--
 PVE/API2/Hardware/USB.pm | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

-- 
2.39.5